929437f507f93afe723a8cde00a677b3baf841fde99281cb1274a3355b202312 | Triage

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 13:42

Sharing

Report Analysis Logs

General

Target

bindevt.dll
Size

448KB
MD5

8477542c8013bd0697660609a5845dd3
SHA1

800644dfe46fb92ec73f5456857b388c3b118022
SHA256

0ee30b5532df951d5c18c3e780d534d795dd9166794b04c18da4056145e8cb05
SHA512

ec1c653fc5e7bf4a1db0c46711917f121b08cf022e960a3e0de6ba9c1e66f5e1d715ace574d2e18838f11cfe5dfc3ad032ccf969d2cd5243efeed724f8c5bb35
SSDEEP

6144:2Lyto9KMLecTR/bsUpbm97VQ8873FKBkDORsnb6ZYtZpdHiVXj:2LKo9PLecFTsU9m9E73FSRsnb6mHIj

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2292	2044	rundll32.exe	28
PID 2044 wrote to memory of 2292	2044	rundll32.exe	28
PID 2044 wrote to memory of 2292	2044	rundll32.exe	28
PID 2044 wrote to memory of 2292	2044	rundll32.exe	28
PID 2044 wrote to memory of 2292	2044	rundll32.exe	28
PID 2044 wrote to memory of 2292	2044	rundll32.exe	28
PID 2044 wrote to memory of 2292	2044	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
  2⤵
  PID:2292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads